Impossibile aprire antivirus

[mimmolins]

Ciao a tutti,
da qualche giorno ho una difficoltaà con il mio pc.
All'avvio non viene eseguito l'antivirus e cercando di lanciarlo manualmente restituisce un errore, ove dice di non trovare un file con estensione .exe.
Tentando di reinstallare lo stesso antivirus o installarle un'altro la situazione non cambia.
Ho tentato di ripristinare il pc ad uno stato precedente ma non mi permette di farlo e mi restituisce un errore generico.
Ho tentato, dopo aver letto alcuni post in giro, ad eseguire delle scansioni antivirus online ma molte si interrompono senza terminare, alcune invece giungono al termine, eliminano i virus trovati ma la situazione non cambia.
L'unico che non sono riuscito ad eliminare è quello rilevato dalla scansione online di norton, il Trojan.Lodeight.C ma non ho idea se il mio problema può essere stato causato da questo cavallo di Troia.
Sapete aiutarmi? Altrimenti mi tocca formattare per l'ennesima volta il pc!!!
Grazie mille.

[Luke57]

Ciao, Scarica systemscan da qui http://www.suspectfile.com/systemscan , avvialo, spunta tutte le opzioni e premi su "Scan now". Alla fine della scansione recati in c:\suspectfile, qui troverai un file del tipo data+ora.zip, carica questo file su http://www.sendmefile.com (non lo incollare in un post perchè è troppo lungo) e scrivi qui il link che ti sarà fornito (il primo) in modo che si possa vedere.

[mimmolins]

Ciao,
grazie mille per la tua risposta.
Ho provato a fare come suggerisci ma non sono riuscito a scaricare systemscan dal link che mi hai dato.
L'errore generato è il seguente:

Warning! You should have already downloaded the last Systemscan version (sys78567.exe).
If you can't download it probably your browser or your firewall is blocking popups.
Please enable popup on your PC and try again.
If you have already popup enabled, hold down the CTRL key and click on this link

Systemscan will be available within 27 seconds.

Ho tentato di disabilitare il blocco popup ma non è cambiato nulla.
Come faccio?
Grazie

[Luke57]

Ciao, lo fa con internet explorer.
proviamo un'altra cosa:
scarica gmer da qui:
http://www.ilsoftware.it/querydl.asp?ID=967

lo avvi, con tutte le applicazioni chiuse e antivirus disattivato, premi il tab>>>, poi il tab. Rootkit, premi scan. Se la scansione temina ( a volte va in crash) premi il tasto copy, si aprirà un file di testo che salverai nel pc.
Poi fai una scansione dal tab. Autostart, in questo caso la scansio e è velocissima, premi copy al termine, salvi il file di testo generato. Siccome sono molto lunghi, inseriscili (anche unendoli in un unico file di testo) nel sito che ti ho dato per inserire il lgo di systemscan.
p.s. se la scansione dalla posizione rootkit non riuscisse, quella con autostart è importante lo stesso.

[mimmolins]

Ciao,
ho fatto come hai detto.
Il link che mi è stato fornito è http://www.sendmefile.com/00582017
Ora che devo fare?
Grazie

[Luke57]

Ciao, ti sei beccato la rogna del nuovo bagle.
scarica avenger sul desktop
http://swandog46.geekstogo.com/avenger.zip
Decomprimi l'archivio
Avvia il file avenger.exe
Seleziona l'opzione "Input Script Manually"
Clicca sulla lente di ingrandimento

Ti si apre una finestra "View/edit script"
All'interno del box bianco,copia e incolla le scritte in neretto:

Files to delete:
C:\WINDOWS\system32\drivers\srosa.sys
C:\WINDOWS\system32\wintems.exe
C:\WINDOWS\system32\hldrrr.exe
C:\WINDOWS\system32\trusted.exe
C:\WINDOWS\system32\drivers\pci32.sys
C:\WINDOWS\system32\drivers\hidr.exe

folders to delete:
C:\WINDOWS\exefnd
C:\Documents and Settings\HP_Administrator\Dati applicazioni\m

registry keys to delete:
HKLM\SYSTEM\CurrentControlSet\Services\srosa
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
HKLM\SYSTEM\CurrentControlSet\Services\pci32
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32

Clicca sul pulsante Done
Clicca sull'icona del semaforo verde
Rispondi due volte Yes
Il pc dovrebbe riavviarsi da solo, se così non fosse riavvialo manualmente.
Posta poi il log generato da avenger, lo trovi in C:\ è un file di testo

Apri il registro di sistema (start>esegui>regedit (lo digiti nello spazio)>OK
Aperto l'editor, clicchi sul segno + accanto alle singole voci, segui questo percorso


HKEY-CURRENT-USER
Software
Microsoft
Windows
CurrentVersion
Run
click sulla cartella Run, se trovi questi valori sulla parte destra della finestra:

drvsyskit
emule_st_key

click tasto dx su ognuno di essi e scegli elimina.

Poi vai qui:
http://www.zonavirus.com/datos/descarga ... ibagla.asp
scarica elibagla, spunta la casella eliminar ficheros automaticamente", e fai la scansione. (devi riavviare il Pc dopo la passata con il tool)

Posta il report di avenger e di elibagla (lo trovi in C:/InfoSat.txt)

[mimmolins]

Ciao,
innanzitutto Grazie!!!
Io non avrei saputo dove mettere le mani.
Tornando a noi, di seguito i log:

Avenger

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\omimngeq

*******************

Script file located at: \??\C:\WINDOWS\cooqoliw.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\system32\drivers\srosa.sys deleted successfully.
File C:\WINDOWS\system32\wintems.exe deleted successfully.


File C:\WINDOWS\system32\hldrrr.exe not found!
Deletion of file C:\WINDOWS\system32\hldrrr.exe failed!

Could not process line:
C:\WINDOWS\system32\hldrrr.exe
Status: 0xc0000034



File C:\WINDOWS\system32\trusted.exe not found!
Deletion of file C:\WINDOWS\system32\trusted.exe failed!

Could not process line:
C:\WINDOWS\system32\trusted.exe
Status: 0xc0000034



File C:\WINDOWS\system32\drivers\pci32.sys not found!
Deletion of file C:\WINDOWS\system32\drivers\pci32.sys failed!

Could not process line:
C:\WINDOWS\system32\drivers\pci32.sys
Status: 0xc0000034

File C:\WINDOWS\system32\drivers\hidr.exe deleted successfully.


Folder C:\WINDOWS\exefnd not found!
Deletion of folder C:\WINDOWS\exefnd failed!

Could not process line:
C:\WINDOWS\exefnd
Status: 0xc0000034



Could not open folder C:\Documents and Settings\HP_Administrator\Dati applicazioni\m for deletion
Deletion of folder C:\Documents and Settings\HP_Administrator\Dati applicazioni\m failed!

Could not process line:
C:\Documents and Settings\HP_Administrator\Dati applicazioni\m
Status: 0xc000003a

Registry key HKLM\SYSTEM\CurrentControlSet\Services\srosa deleted successfully.
Registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA deleted successfully.


Registry key HKLM\SYSTEM\CurrentControlSet\Services\pci32 not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Services\pci32 failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Services\pci32
Status: 0xc0000034



Registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32 not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32 failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32
Status: 0xc0000034


Completed script processing.

*******************

Finished! Terminate.

EliBagle


Sat Sep 22 22:23:26 2007
EliBagle v10.57 (c)2007 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\BAN_LIST.TXT --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\EMILIANO\DATI APPLICAZIONI\M\FLEC006.EXE --> Bagle.dldr Renombrado a .VIR
C:\DOCUMENTS AND SETTINGS\EMILIANO\DATI APPLICAZIONI\M\LIST.OCT --> Eliminado Bagle
Eliminada Carpeta "%WinDir%\exefld"

Sat Sep 22 22:23:57 2007
EliBagle v10.57 (c)2007 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\
Exploración Detenida por el Usuario.

Sat Sep 22 22:24:05 2007
EliBagle v10.57 (c)2007 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\
Exploración Detenida por el Usuario.

Sat Sep 22 22:24:55 2007
EliBagle v10.57 (c)2007 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP72\A0008759.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP72\A0008774.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP72\A0008825.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP72\A0008826.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP72\A0008833.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP72\A0008842.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP72\A0008843.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP72\A0008851.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP73\A0008925.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP73\A0008928.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP74\A0008945.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP74\A0008977.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP75\A0009011.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP75\A0009012.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP75\A0009027.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP75\A0009030.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP75\A0009040.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP75\A0009057.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP75\A0009058.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP75\A0009066.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP76\A0009195.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP76\A0009196.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP76\A0009199.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP76\A0009210.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP76\A0009211.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP76\A0009298.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP76\A0009318.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP76\A0009406.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP76\A0009416.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP77\A0009570.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP78\A0009573.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP78\A0009580.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP78\A0009581.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP79\A0009584.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP79\A0009595.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP79\A0009596.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP79\A0009597.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP79\A0009622.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP79\A0009623.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP79\A0009633.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP79\A0009634.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP79\A0009663.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP79\A0009669.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP79\A0009687.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP80\A0009854.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP80\A0009855.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP80\A0009856.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP80\A0009865.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP80\A0009866.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP80\A0009867.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP80\A0009868.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP80\A0009869.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP80\A0009870.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP80\A0009871.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP80\A0009872.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP80\A0009873.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP80\A0009874.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP80\A0009875.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP80\A0009876.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP80\A0009877.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP80\A0009878.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP80\A0009879.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP80\A0009880.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP80\A0009881.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP80\A0009882.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP80\A0009883.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP80\A0009884.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP80\A0009885.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP80\A0009886.EXE --> Eliminado Bagle.dldr

Sat Sep 22 22:30:02 2007
EliBagle v10.57 (c)2007 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):
Eliminada Carpeta "%AppData%\M"

Attendo istruzioni!
Ciao

[Luke57]

Ciao, esegui nuove scansioni con elibagla e con Gmer, inserendo nel sito i relativi report.
Fai una scansione on line anche con kaspersky da qui:
http://www.kaspersky.com/service?chapter=161739400
CITAZIONE
1.Clicca su Kaspersky Online Scanner
2.Scarica un componente ActiveX da Kaspersky, Clicca su "Yes."
3.Attendi la fine del download
4.Clicca su "Next"
5.Clicca su "Scan Settings"
6.Assicurati che siano spuntate le seguenti voci
Scan using the following Anti-Virus database:
Extended
spunta le voci di "Scan options"
Scan Archives
Scan Mail Bases
7.Clicca su "OK"
8.Scegli "My computer"
Attendi la fine della scansione, se viene rilevato qualcosa salva il rapporto cliccando su "Save as Text"

Inserisci anxhe questo rapporto.

[mimmolins]

Ciao,
sto facendo le scansioni.
Iglebagle non ha rilevato nulla ora sto lanciando quella con gmer!

Una volta risolto il tutto sai consigliarmi un antivirus, fra quelli gratuiti, che possa assicurarmi una protezione sufficientemente efficace? Ho sempre usato Avast, ma non è la prima volta che si lascia sfuggire qualche virus.
Grazie

[mimmolins]

Ciao,
Kapersky ha rilevato 5 virus che i due precedenti non hanno individuato....
Di seguito il log:
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Sunday, September 23, 2007 10:28:55 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.1
Kaspersky Anti-Virus database last update: 23/09/2007
Kaspersky Anti-Virus database records: 422508
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\

Scan Statistics:
Total number of scanned objects: 52225
Number of viruses found: 5
Number of infected objects: 38
Number of suspicious objects: 0
Duration of the scan process: 00:49:44

Infected Object Name / Virus Name / Last Action
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{CCC7DC6E-C3BC-48D7-B633-16D555E05C85}.bin Object is locked skipped
C:\WINDOWS\S86BB4934.tmp Object is locked skipped
C:\WINDOWS\ModemLog_Modem standard su collegamento Bluetooth #4.txt Object is locked skipped
C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Emiliano\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Emiliano\Impostazioni locali\Temp\~DFE448.tmp Object is locked skipped
C:\Documents and Settings\Emiliano\Impostazioni locali\Temp\~DFE44F.tmp Object is locked skipped
C:\Documents and Settings\Emiliano\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Emiliano\Impostazioni locali\Cronologia\History.IE5\MSHist012007092320070924\index.dat Object is locked skipped
C:\Documents and Settings\Emiliano\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Emiliano\Impostazioni locali\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Emiliano\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Emiliano\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Emiliano\Impostazioni locali\Dati applicazioni\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Emiliano\Impostazioni locali\Dati applicazioni\Adobe\Acrobat\8.0\Updater\updater.log Object is locked skipped
C:\Documents and Settings\Emiliano\Impostazioni locali\Dati applicazioni\Adobe\Updater5\aumLib.log Object is locked skipped
C:\Documents and Settings\Emiliano\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Emiliano\ntuser.dat Object is locked skipped
C:\Documents and Settings\Emiliano\.housecall6.6\Quarantine\data.oct.bac_a01164 Infected: Trojan-Downloader.Win32.Bagle.eb skipped
C:\Documents and Settings\Emiliano\.housecall6.6\Quarantine\SynTPLpr.exe.bac_a01164 Infected: Trojan-Downloader.Win32.Bagle.du skipped
C:\Documents and Settings\Emiliano\.housecall6.6\Quarantine\Nitro Web Accelerator 5.7.zip.bac_a01164/Nitro Web Accelerator 5.7.exe Infected: Trojan-Downloader.Win32.Bagle.du skipped
C:\Documents and Settings\Emiliano\.housecall6.6\Quarantine\Nitro Web Accelerator 5.7.zip.bac_a01164 ZIP: infected - 1 skipped
C:\Documents and Settings\Emiliano\.housecall6.6\Quarantine\Nitro Web Accelerator 5.7.zip.bac_a01164 CryptFF.b: infected - 1 skipped
C:\Documents and Settings\Emiliano\.housecall6.6\Quarantine\Web Services Accelerator 2.01.zip.bac_a01164/Web Services Accelerator 2.01.exe Infected: Trojan-Downloader.Win32.Bagle.du skipped
C:\Documents and Settings\Emiliano\.housecall6.6\Quarantine\Web Services Accelerator 2.01.zip.bac_a01164 ZIP: infected - 1 skipped
C:\Documents and Settings\Emiliano\.housecall6.6\Quarantine\Web Services Accelerator 2.01.zip.bac_a01164 CryptFF.b: infected - 1 skipped
C:\Documents and Settings\Emiliano\.housecall6.6\Quarantine\A0008755.exe.bac_a01164 Infected: Trojan-Downloader.Win32.Bagle.du skipped
C:\Documents and Settings\Emiliano\.housecall6.6\Quarantine\A0008773.exe.bac_a01164 Infected: Trojan-Downloader.Win32.Bagle.du skipped
C:\Documents and Settings\Emiliano\.housecall6.6\Quarantine\A0008803.exe.bac_a01164 Infected: Trojan-Downloader.Win32.Bagle.du skipped
C:\Documents and Settings\Emiliano\.housecall6.6\Quarantine\A0008804.exe.bac_a01164 Infected: Trojan-Downloader.Win32.Bagle.du skipped
C:\Documents and Settings\Emiliano\.housecall6.6\Quarantine\A0008823.exe.bac_a01164 Infected: Trojan-Downloader.Win32.Bagle.du skipped
C:\Documents and Settings\Emiliano\.housecall6.6\Quarantine\A0008841.exe.bac_a01164 Infected: Trojan-Downloader.Win32.Bagle.du skipped
C:\Documents and Settings\Emiliano\.housecall6.6\Quarantine\A0008924.exe.bac_a01164 Infected: Trojan-Downloader.Win32.Bagle.du skipped
C:\Documents and Settings\Emiliano\.housecall6.6\Quarantine\A0008943.exe.bac_a01164 Infected: Trojan-Downloader.Win32.Bagle.du skipped
C:\Documents and Settings\Emiliano\.housecall6.6\Quarantine\A0009010.exe.bac_a01164 Infected: Trojan-Downloader.Win32.Bagle.du skipped
C:\Documents and Settings\Emiliano\.housecall6.6\Quarantine\A0009026.exe.bac_a01164 Infected: Trojan-Downloader.Win32.Bagle.du skipped
C:\Documents and Settings\Emiliano\.housecall6.6\Quarantine\A0009038.exe.bac_a01164 Infected: Trojan-Downloader.Win32.Bagle.du skipped
C:\Documents and Settings\Emiliano\.housecall6.6\Quarantine\A0009055.exe.bac_a01164 Infected: Trojan-Downloader.Win32.Bagle.du skipped
C:\Documents and Settings\Emiliano\.housecall6.6\Quarantine\A0009193.exe.bac_a01164 Infected: Trojan-Downloader.Win32.Bagle.du skipped
C:\Documents and Settings\Emiliano\.housecall6.6\Quarantine\A0009208.exe.bac_a01164 Infected: Trojan-Downloader.Win32.Bagle.du skipped
C:\Documents and Settings\Emiliano\.housecall6.6\Quarantine\A0009296.exe.bac_a01164 Infected: Trojan-Downloader.Win32.Bagle.du skipped
C:\Documents and Settings\Emiliano\.housecall6.6\Quarantine\A0009404.exe.bac_a01164 Infected: Trojan-Downloader.Win32.Bagle.du skipped
C:\Documents and Settings\Emiliano\.housecall6.6\Quarantine\A0009569.exe.bac_a01164 Infected: Trojan-Downloader.Win32.Bagle.du skipped
C:\Documents and Settings\Emiliano\.housecall6.6\Quarantine\A0009574.exe.bac_a01164 Infected: Trojan-Downloader.Win32.Bagle.du skipped
C:\Documents and Settings\Emiliano\.housecall6.6\Quarantine\A0009579.exe.bac_a01164 Infected: Trojan-Downloader.Win32.Bagle.du skipped
C:\Documents and Settings\Emiliano\.housecall6.6\Quarantine\A0009585.exe.bac_a01164 Infected: Trojan-Downloader.Win32.Bagle.du skipped
C:\Documents and Settings\Emiliano\.housecall6.6\Quarantine\A0009594.exe.bac_a01164 Infected: Trojan-Downloader.Win32.Bagle.du skipped
C:\Documents and Settings\Emiliano\.housecall6.6\Quarantine\A0009617.exe.bac_a01164 Infected: Trojan-Downloader.Win32.Bagle.du skipped
C:\Documents and Settings\Emiliano\.housecall6.6\Quarantine\A0009661.exe.bac_a01164 Infected: Trojan-Downloader.Win32.Bagle.du skipped
C:\Programmi\PC Tools AntiVirus\PCTAVService.txt Object is locked skipped
C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP82\change.log Object is locked skipped
C:\avenger\backup.zip/avenger/srosa.sys Infected: Trojan-Downloader.Win32.Bagle.dt skipped
C:\avenger\backup.zip/avenger/wintems.exe Infected: Trojan-Downloader.Win32.Bagle.dy skipped
C:\avenger\backup.zip/avenger/hidr.exe Infected: Trojan-Downloader.Win32.Bagle.du skipped
C:\avenger\backup.zip ZIP: infected - 3 skipped
D:\software\browser\Torpark_2.0.0.3a.exe/Torpark 2.0.0.3a/App/Tconfig.exe/data0004 Infected: not-a-virus:RiskTool.Win32.FWDisabler.a skipped
D:\software\browser\Torpark_2.0.0.3a.exe/Torpark 2.0.0.3a/App/Tconfig.exe Infected: not-a-virus:RiskTool.Win32.FWDisabler.a skipped
D:\software\browser\Torpark_2.0.0.3a.exe 7-Zip: infected - 2 skipped

Scan process completed.

Ora che faccio?
Grazie

[Luke57]

Ciao, svuota la quarantena di housecall ed elimina la cartella di backup generata da avenger.
Poi posta i report di gmer.

[mimmolins]

Ciao,
ho eliminato la cartella di backup di avenger ed ho svuotato la cartella quarantena di housecall.
Ho lanciato gmer ed ho caricato il report al seguente link (erano 11 pagina in word):
http://www.sendmefile.com/00582598

Nel frattempo sono riuscito ad installare un antivirus (AntiVir) e sembra funzionare.

Secondo te il problema è risolto? Devo cambiare antivirus?
Grazie

[Luke57]

Ciao, il fatto che sei riuscito a installare l'antivirus dovrebbe indicare che ti sei liberato del malware.
Comunque, disistalla completamente avast oppure tienilo disattivato, altrimenti potrebbe entrare in conflitto con antivir (meglio di avast, secondo me).

[mimmolins]

Grazie mille.
Il tuo aiuto è stato prezioso.
Non mi ero mai iscritto ad un Forum, ma devo dire che sbagliavo.
Ciao